Updated: 25 August 2026
Your data
These pages have been reviewed by no lawyer. They describe faithfully what the service does today, and on that point they bind Mizan. A legal review remains necessary before any commercial opening, and is recorded as such in the project's follow-up.
The principle, in one sentence
We keep strictly what the service needs to work, we say exactly what, and you can take it all away or erase it all from your space, without writing to us.
At a marriage agency, the mere fact that someone is registered is already sensitive information. That is what this page protects first.
Who is responsible for your data
Mizan, Rua Eng. Adelino Amaro da Costa, Castro Daire, Portugal.
That is the body which decides what is collected and why: the « controller » within the meaning of the GDPR.
You exercise your rights from your own space, without writing to anyone: §5 says which one is where. If you would rather write, or if a right cannot be exercised from the screen, the address is the same as everywhere else.
If you believe your data is being mishandled, you may refer the matter to the supervisory authority of your country of residence, or to that of the country where the service is established — in Portugal, the CNPD.
1. What we keep
This list covers every piece of personal data the database keeps. It is reviewed at each change of the model: if a line is missing, that is a defect, and it is reported at the address in §5.
| Data | Why | Until when |
|---|---|---|
| Email address | Login identifier, and the only way to reach you | Account deletion |
| Password fingerprint | Recognise you without knowing your password | Account deletion |
| First name, age, date of birth (if you provide it), gender, gender sought, city, country | Profile content. The gender sought alone decides who is shown to you, and to whom you are shown: without it, no one can be proposed to you. | Account deletion |
| Marriage horizon, mobility, plans for children, kind of household | The four criteria shown at the top of a profile | Account deletion |
| Introduction text | What you write about yourself | Account deletion |
| Date the file was paused, and the state it was in before | Two things, and the second is what makes the pause reversible: the date says that you are paused, and the previous state — file published or not, emails enabled or not — lets us give you back exactly what was taken away. Without it, resuming would publish a file that had never been published, or switch back on emails you had refused. | Resuming the file, or account deletion |
| Identity document number, a guardian’s telephone | Both optional. The number serves verification, the guardian’s telephone serves to reach the family when you ask for it. Neither is shown to anyone, and you can erase them at any time. | Account deletion |
| Position on polygamy, declared illness or disability, complexion | Optional. Health and complexion are sensitive data within the meaning of Article 9: your consent is logged when you give it and when you withdraw it, and the log never keeps the value. None of the three rules a file out by itself. | Account deletion |
| Religion, and your relation to it — optional | Sensitive data within the meaning of article 9 GDPR. The entry form does not ask for it; it is recorded only from your space, and only if you tick the consent box. It serves only so that those for whom it matters can make it a criterion. You withdraw it by choosing « Prefer not to say ». | Account deletion, or withdrawal of consent |
| Origin, one or two — optional | Distinct from where you live. Some people make it a criterion, others ignore it. Filled in from your space, never asked on entry. | Account deletion, or clearing the field |
| Occupation — optional | What you do, in a few words and in your own words. One more landmark for the agency, never a sorting criterion: free text is not filtered on, that would amount to sorting on spelling. | Account deletion, or clearing the field |
| Level of education — optional | On the international ISCED scale, so a qualification reads from one country to another. Serves as a criterion for whoever sets one. | Account deletion, or clearing the field |
| Income, by bracket — optional | A bracket, never an amount: the exact figure has no use here and many drawbacks if it leaks. | Account deletion, or clearing the field |
| Way of life: tobacco, alcohol, interests — optional | What is lived daily and otherwise discovered too late. None of it excludes anyone outright. | Account deletion, or clearing the field |
| Appearance: height, build, eyes, hair — optional | Landmarks, not criteria. No photo is published, and these fields do not replace a photo: they situate, they do not show. | Account deletion, or clearing the field |
| File photos: up to four, and which one you designate as the main one | Optional. They are never published and no other member sees them: only the agency opens them, to recognise your file and prepare an introduction. The image itself is not kept in the database: it is placed on a server disk, under a randomly drawn name that does not say whom it belongs to. | Removal by you at any time, or deletion of the account |
| Appointments: date, duration, channel (video call or telephone), subject, status and report | The interview is part of the process: without a trace, the agency no longer knows whom it met nor what was said. The report is written by the agency, never by you, and shown to no one else. | Account deletion |
| Internal notes written by the agency about your file | What the agency keeps in order to work: « call back after the move », « does not wish to be introduced before June ». Written by someone at the agency, never by you, and never shown to another member. They appear here because they are about you. | Account deletion |
| Verification level reached | What the agency has been able to verify of your identity before introducing you | Account deletion |
| Minimum threshold you require | The verification level the agency must have reached on someone before introducing them to you | Account deletion |
| Your search requirements — area, country, city, origin, religion, level of education, age, horizon, verification level | What you ask of the other person, and how much you hold to it. A requirement about religion falls under article 9 just as your own does: it is recorded only if you set that criterion, and an absent preference is not a zero requirement — it is the absence of a requirement. | Account deletion, or withdrawal of the criterion |
| Date your address was confirmed | Prove the address is yours. The confirmation link itself is never kept: only its fingerprint, and that is erased as soon as the link has served. | Account deletion |
| Opening notice: your email address, the language of the page, the page you left it from, and the exact text you agreed to | To tell you on the day we open, and nothing else. The consent text is kept word for word: if we change that sentence tomorrow, only the timestamped copy says what you agreed to. This notice is separate from an account: leaving it does not create one, and gives none. | Until you unsubscribe, in one click from any of our emails. The row is then kept with only the date of your refusal: deleting it would let someone else sign you up again, and your refusal would not hold. |
| Emails sent to you: the kind of message, the date, whether it left our server, and if not why | Knowing whether a message really left for you. Without this line, an email blocked by a failure looked, from our side, like an email received — and nobody could answer you when you told us you had received nothing. The text of the message is not kept, only its kind. And this line does not say you received or read it: we place no tracking pixel, so we do not know. | Deleting the account, which erases it by your address too |
| Open sessions | Keep you signed in for fourteen days | Signing out, expiry or deletion |
| Requests sent and received, with their text, and the closing of a conversation — its date, and who closed it | That is what the service consists of. Closing is visible on both sides: that is what sets it apart from blocking, which stays silent | Deletion of either person's account |
| Messages exchanged in a conversation, with their text and the time they were read | An accepted approach opens a thread; without these lines there is no conversation. They are readable only by the two of you, and by a moderator if one of you reports a particular message. | Deletion of either person's account |
| Identity check decision: its result, its date, who made it, and a fingerprint of what was submitted | To prove that a check took place, and which level it entitles you to. Neither the selfie nor the identity document is kept: they live outside the database, are erased as soon as the decision is made, and at the latest two hours after they were submitted. The fingerprint makes it possible to recognise an identical resubmission without keeping the image. | See §3 |
| Blocks | Make a block hold both ways | See §3 |
| Reports you have made | Moderation | See §3 |
| Log of sensitive actions | Evidence in case of a complaint, security of the service | See §3 |
| Rate counters | Prevent automated collection and harassment | One hour |
| Stage of your journey with someone | Follow where a relationship stands. A stage only advances if the other confirms. | Deletion of either person's account |
| History of stages passed | Knowing when a stage was passed, and by whom | Deletion of either person's account |
| Your private notes on a journey | A notebook, never shown to the other person | Deletion of either person's account |
| Family circle: a relative’s address, their role, a fingerprint of the link | Letting a relative follow without an account. The link is never stored in clear. | Revocation by you, expiry, or account deletion |
| What each relative may see | You choose, scope by scope | Account deletion |
| A relative’s opinion, and their note | Giving you feedback, to you alone | Account deletion |
| Your feedback after a stage | Writing what you think without the other reading it. No route returns it to them. | Deletion of either person's account |
| The languages you declare you speak | Telling whether two people share a language | Account deletion |
| The fact that an account holds a support role | Nobody holds this role today | Account deletion |
| An offer of support, and your answer | Support is offered, never imposed | Account deletion |
| The working notes of whoever supports you | Their observations, never handed over | Account deletion |
| The profiles offered to you, and the reason | A recommendation forces nothing | Account deletion |
| The planned plans | None is active, and no price is stored | Account deletion |
| What a plan could open | Human support only. Never visibility. | Account deletion |
| Your plan, if you had one | No subscription exists today | Account deletion |
| What you would have paid, and at which point | No service exists: nothing is invoiced | Account deletion |
| The skin tone you state | Optional, and it never rules anyone out | Account deletion |
| Your path to Islam, if you say it | Optional: nobody judges this answer | Account deletion |
| An income bracket, never an amount | Optional, and by bracket only | Account deletion |
| A photograph, if you submit one | Never published: it leaves only with your agreement | Account deletion |
| To whom your file was presented, and when | No sharing without your dated agreement | Account deletion |
| The declared learning engines | None is declared, and none is active | Account deletion |
| A suggestion, its origin and its explanation | No suggestion is produced. When there are, each will say where it comes from and why. | Account deletion |
| Your consent to automated processing | It is asked of nobody: nothing is processed automatically. | Account deletion |
| The service events we have told you about (rule change, maintenance, outage, update, new feature), and the date of each message | To tell you only once per event, and in your language. No content is kept here: only the fact and the date that a message was sent to you. Each of these messages carries a link that is enough to stop receiving them, with no account and no password; that refusal is noted on your account, with its date. | Account deletion |
2. What we never keep
- Your identity document. It is checked, then deleted. We keep the level reached, never the document, never a copy, never a number.
- Your password. Only an irreversible fingerprint is stored.
- Your location. No location data is collected. The city is a declaration, not a measurement.
- Your contacts. No access to the address book, on any device.
3. What outlives the deletion of your account, and why
Deleting your account erases your profile and closes your sessions, at once. Three things survive, and it would be dishonest not to say so:
- The log of actions — who published, blocked, reported, and when. It is kept anonymised: the line no longer points to anyone. Without it, no evidence would remain in case of a complaint.
- The reports about you. Without that exception, closing an account would be enough to erase the reports against you, then open another.
- The blocks you placed. A block protects someone else. Erasing it by closing your account would give the blocked person back a visibility you had refused — and they would not be told. The line remains; it no longer carries your identity.
A policy promising complete erasure while those lines survive would be a false policy.
4. Your rights, and how to exercise them without writing to us
| Right | How | Time |
|---|---|---|
| Access and portability | « Export my data » in your space: everything appears, ready to copy | Immediate |
| Rectification | Modify your file in your own space | Immediate |
| Erasure | « Delete my account » in your space | Immediate |
| Objection and restriction | « Pause my file » in your own space: the agency stops searching and introduces no one to you, without anything being erased | Immediate |
None of these rights asks for a justification, a form, or an exchange of letters. That is a choice: a right that requires writing to an address and waiting a month is not exercised.
5. Cookies and audience measurement
A single cookie is set, and only once signed in: the session cookie. It is HttpOnly — so out of reach of any script —, SameSite=Strict — so never sent from another site —, and it expires after fourteen days.
Audience measurement is done by our own servers, with no external service at all: no cookie, no personal data, no resale. Your IP address and browser are never stored as such — they are used for an instant to compute a one-time fingerprint, valid for a single day, then discarded. We will never know who read what.
To know which pages search engines help people find, the page also sends only the name of the site you arrive from — a search engine, a social network — without the page address or your search. It is used to place the visit in one of four categories — direct access, search engine, social network, other site — then discarded.
The list of cities offered at sign-up comes from GeoNames. That data is public and loaded from our own servers: no request goes to GeoNames during your visit, and no one there learns where you live. The attribution is cited here because the licence requires it.
6. Who can see your data
- The agency reads your file in full. That is its work: without reading it, it cannot search in your place. The person who reads it is the one who follows your file from start to finish. They see what you wrote, your criteria, your email address and the internal notes they took themselves.
- Every named reading leaves a trace: the date, and who opened it. Opening a file and consulting the list of accounts have been written to the journal since 5 September 2026.
- Other registered people see nothing. There is no list, no search, no directory: your file is shown to no one without your agreement and the other person's, and what is then shown contains no contact details.
- Moderation: reports and the files they target.
- No one else. No data is sold, rented, shared for advertising, or passed to a third party.
One limit remains. Data is not encrypted at rest: a person with access to the server can read it. This item is identified in the project's threat model.
7. Hosting and transfers
The service runs on a virtual private server rented from OVH. According to the RIPE registry, this server’s address range (92.222.64.0 – 92.222.95.255) is registered to OVH, in France. Your data therefore stays within the European Union.
No transfer outside the European Union is in place: no backup, no third-party service, no external audience measurement tool. Email goes through OVH, also in Europe.
What this section is worth, and what it is not: the country in the registry is the one the operator declares for this address range. That is the best verification available from outside, not an on-site finding. If the hosting changes country, this page will change first, not after.
8. Security
- Passwords protected by scrypt, never in the clear.
- The session token is given once; only its fingerprint is stored. A leak of the database makes no session usable.
- Every query to the database goes through prepared statements.
- Search is bounded in number of results and in rate, which makes automated collection of profiles costly.
- No execution trace is returned to the browser on error.
These protections are checked by automated tests, and several of them have been proved by deliberately breaking the code to see the test fail.